The challenge
This risk needs no attacker. An employee who wants to work faster pastes a patient summary, contract terms or a piece of source code into a public AI tool, and the data leaves your control in seconds. Illustrative example: a doctor asks a public tool to rewrite a report that carries the patient's name and file number. Under the Personal Data Protection Law (PDPL), health data is sensitive data.
Regulators are moving to control this use, not to forbid it. The Saudi Data and Artificial Intelligence Authority (SDAIA) Generative AI Guidelines for Government require government employees not to enter data classified Restricted or higher into these tools and limit their use to data classified Public, and SDAIA's guidelines for the public advise organisations to adopt usage policies that prohibit entering classified information into third-party tools. The National Cybersecurity Authority (NCA) Data Cybersecurity Controls (DCC) require data leakage prevention and rights management technologies for data classified above Public at the organisations they apply to, and NCA's implementation guide gives the use of unapproved generative AI systems as an example of data leakage.
This guidance does not call for a blanket ban, and a ban cannot reach personal phones and accounts outside your controls. So we build a balanced approach: approved tools on your organisation's accounts, policies that stop only sensitive data, messages that explain the reason to the employee, and an incident record that shows what actually happened.
How we work
- 1
Discover usage
We start in monitor mode: which AI tools are used, by whom, and what kinds of data reach them, without disrupting work. We also review the DLP, web security and browser controls you already have before proposing anything new.
- 2
Design the policies
We define the approved tools and accounts, and the protected data categories, such as national ID numbers, bank account numbers (IBAN), medical records and classified documents in Arabic and English, and decide for each one, as far as the chosen solution supports it: allow, warn and ask for a justification, or block.
- 3
Enforce and record
We switch the policies on in stages across browsers, endpoints and gateways, send incidents to your SIEM or SOC, tune the rules to cut false positives, and issue periodic reports to management and the data protection officer.
What is included
AI app discovery (shadow AI)
Visibility of the AI tools actually in use, approved and unapproved, who uses them and how much.
Prompt and paste inspection
Inspection of text pasted or typed into AI tools before it is sent, as far as the chosen solution supports it.
File upload control
Blocking or warning on uploads of classified files, or files containing sensitive data, to AI sites, as far as the chosen solution supports it.
Sensitive data detectors
Patterns, dictionaries and classifiers that recognise personal, health and financial data, source code and classification labels, with Arabic detection accuracy tested on samples of your data.
Organisation versus personal accounts
Allowing the approved tool on your organisation's account while restricting personal accounts on the same tool, where the solution supports it.
User coaching
On-screen messages that tell the employee why an action was stopped and point them to the approved tool, with a business-justification option where the solution supports it and your policy allows.
Incident logging and SIEM integration
A record of each detected attempt, with the user, device, tool, data type and action taken, sent to your SIEM and SOC.
Enterprise AI integrations
Connecting enterprise AI tools, where they offer it, to audit and compliance solutions through their compliance APIs, for after-the-fact audit and retention rather than real-time blocking.
Frameworks and regulations
We align the service with the frameworks your organisation is subject to.
- PDPL
- NCA DCC
- SDAIA GenAI
Our technology partners for this service
Selected examples, not a complete list: we also work with other technology companies and with the platforms you already own.
Frequently asked questions
Does this mean blocking ChatGPT and similar tools?
No. The aim is safe use: approved tools stay available, and only sensitive data is blocked or flagged. Even SDAIA's guidelines for government entities do not ban these tools; they restrict the data that may be entered.
Which AI tools are covered?
Common tools such as ChatGPT, Gemini, Claude and Microsoft Copilot, and others the solutions recognise in their generative AI category. Exact coverage varies by solution, browser and operating system, so we verify it in your environment before you rely on it.
Do we need a new product?
Not necessarily. Many DLP, web security and secure browser solutions have added generative AI controls, and they may already be in your licences, although some features need extra licences or vendor enablement. We start by assessing what you have, and only propose additions to close a clear gap.
Do the solutions recognise Arabic content?
We test it in the first phase. We build detectors for local patterns such as national ID and iqama numbers and Saudi IBANs, and measure how accurately Arabic text is detected on samples of your data before moving to blocking.
What about employee privacy?
We design the policies to record only what an incident needs, and recommend telling staff about the policy in advance through the acceptable use policy, and defining who can see the logs and how long they are kept, with your data protection officer.
Are unmanaged devices covered?
Only partly. The controls work on managed devices, approved browsers and web traffic that passes through your gateways. For personal devices outside that, we reduce the risk through access policies, such as limiting approved tools to managed devices, and through awareness.
What about AI built into productivity apps?
Assistants such as Microsoft Copilot and Gemini in Google Workspace run within your organisation's accounts, so controlling them relies mainly on the platform's own settings, such as Google Workspace DLP rules for Gemini and the audit logs of prompts and responses, and on rights management for sensitive files. We review these settings alongside our data security service to reduce the risk of an assistant exposing content to users who should not see it.
Related services
Security Solutions
Data Security
Data classification, loss prevention and encryption aligned with PDPL.
Govern & Comply
Awareness & Training
Awareness programmes and phishing simulations with measurable results.
Govern & Comply
GRC Advisory
Policies, procedures and risk management built on NCA, SAMA and ISO 27001 controls.
Detect & Respond
Incident Response
Contain, investigate and recover from incidents with documented procedures.
Contact
Let's talk about what you need
We answer enquiries through the form, WhatsApp, a call or email.
Mobile (calls and WhatsApp)
+966 59 750 4669Email
info@datasec.sa